Data Processing Addendum

This page is maintained by Pinstripe Business Services LLC to describe how we process personal data on behalf of business customers. It is not a certification and does not replace a signed agreement. To execute a countersigned DPA, contact us at privacy@pinstripeservices.com.

1. Parties and Roles

Pinstripe Business Services LLC ("Pinstripe", "we") acts as a data processor for personal data that our business customers ("Customer", "you") upload to, or process through, the Pinstripe portal in connection with the services described in the Terms of Service. Customer is the data controller for that data.

2. Scope and Duration

This DPA applies to the processing of personal data for the duration of the applicable services agreement. It supplements, and does not replace, our Privacy Policy.

3. Nature and Purpose of Processing

Delivering bookkeeping, consulting, automation, and web services requested by Customer.
Providing portal features: file storage, messaging, invoices, consultations, referrals.
Producing operational reports for Customer and responding to support requests.

4. Categories of Data and Data Subjects

Customer personnel and clients: name, email, phone, business role.
Business records Customer submits: invoices, financial documents, receipts, correspondence.
Portal telemetry: authentication events, request status changes, message metadata.

Customer is responsible for ensuring it has a lawful basis to share this data with us and for not submitting special-category data unless we have agreed to it in writing.

5. Subprocessors

We use vetted service providers to run the platform. Current subprocessors:

Supabase: managed Postgres, auth, storage, edge functions (US region).
Stripe: payment processing and billing.
Resend: transactional and newsletter email delivery.
Google (Workspace and Search Console): business email and search analytics.
Cloudflare: DNS, CDN, edge services, and encrypted Pinstripe Sync file storage.
OpenAI: AI features for portal chat and content assistance.

We will give Customer reasonable notice of new subprocessors by updating this page. Customer may object in writing within 30 days; if the objection cannot be resolved, Customer may terminate the affected service.

6. Security

Encryption in transit (TLS) for all portal traffic.
Encryption at rest provided by our infrastructure providers.
Row-level security policies on every user-data table.
Least-privilege access for staff; admin actions logged.
Multi-factor authentication available and enforced for admin accounts.
Regular dependency updates and security scanning.

These are current, enabled controls. This DPA is not a security certification and does not commit Pinstripe to a specific compliance framework unless separately agreed in writing.

7. Confidentiality and Personnel

Personnel who access Customer data are bound by confidentiality obligations and receive training on handling business records.

8. Data Subject Rights

We will support Customer in responding to data-subject requests (access, correction, deletion, restriction, portability) to the extent technically feasible through the portal or by request to privacy@pinstripeservices.com.

9. International Transfers

Data is primarily stored in the United States. Where subprocessors transfer data internationally, they rely on their published transfer mechanisms (e.g. Standard Contractual Clauses). Contact us for the current list.

10. Breach Notification

We will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer data, and will provide the information required to meet Customer's own notification obligations.

11. Return and Deletion

On termination, Customer may export their data through the portal for 30 days. After that window, we delete or anonymize Customer data unless retention is required by law (e.g. financial recordkeeping).

12. Audits

Once per year, on reasonable notice and subject to confidentiality, Customer may request a summary of our security controls and subprocessor list. On-site audits are available for enterprise customers by separate written agreement.

13. Contact

Questions about this DPA: privacy@pinstripeservices.com.

Last updated: July 27, 2026.